Brute-Force Protection
A set of security measures designed to prevent automated password-guessing attacks.
Detailed Explanation
Common measures include: (1) Account Lockout: temporarily locking an account after multiple failed attempts. (2) Progressive Delay: increasing the time between allowed attempts. (3) CAPTCHA: verifying the user is human. (4) IP Rate Limiting: blocking IPs that make too many failed requests. These are essential for any public login page.
Quick Summary
Brute-force protection layers controls, rate limits, lockouts, CAPTCHAs, and MFA, so that even attackers with billions of guesses can't enumerate passwords against your login endpoint.
Key Takeaways
- Defense in depth: per-account lockout + per-IP rate limit + CAPTCHA on anomaly + MFA enforced.
- Lockout alone enables a denial-of-service vector, attackers can lock real users out by guessing their accounts.
- Progressive delays (exponential backoff per account) slow attacks without locking out users completely.
- Distributed credential stuffing spreads guesses across many IPs; per-IP limits alone won't catch it.
- Pair with breach-password rejection (HaveIBeenPwned) so users can't reuse known-compromised credentials.
When to use it
- Login forms, password-reset endpoints, and 2FA verification, all of these are bot targets.
- Public API endpoints where keys or tokens are guessed by automated tools.
- Account creation flows to limit signup spam and abuse.
- Admin interfaces facing the internet, even with strong passwords, automated tools find them quickly.
Common Mistakes
- Returning different error messages for "wrong password" vs "unknown user", gives attackers free user enumeration.
- CAPTCHA on every login, drives away real users while sophisticated bots already bypass most CAPTCHAs.
- IP-only rate limits behind a CDN, so the entire CDN's egress shares one bucket.
- Skipping protection on password reset and 2FA endpoints, which attackers target once login is hardened.
Brute-Force Protection, Frequently Asked
How do I prevent CAPTCHA from annoying real users?
Only show CAPTCHA on anomaly, high failure rate from this IP, new device, suspicious user agent. Tools like reCAPTCHA v3 and Cloudflare Turnstile score risk silently and only challenge when needed.
Is MFA enough on its own?
MFA blocks the takeover, but attackers still hammer login endpoints to validate stolen credentials they'll use elsewhere (credential stuffing). Even with MFA enforced, you want rate limits and bot protection on the login surface.